Introduction to cybersecurity

Authentication, Authorization, and Accounting (AAA)

  • Authentication vs. Authorization:

    • Authentication: The process of verifying the identity of a user or system (e.g., validating a username and password).

    • Authorization: The process of verifying whether an authenticated user has permission to access specific resources or perform specific actions (e.g., granting access to a desktop environment or specific files).

    • Common Industry Conflation: Information Technology processes frequently combine authentication and authorization into a single visible step (e.g., logging into a Windows workstation simultaneously authenticates credentials and authorizes desktop access).

    • Distinct Execution Example: Web applications often illustrate the separation of these controls by successfully authenticating a user's credentials but immediately displaying an "unauthorized" message when access to a restricted sub-resource is blocked.

  • Accounting:

    • Definition: The systematic tracking, logging, and auditing of user activities, access attempts, and system events.

    • Value of Failure Logs: Logged failure events often provide more critical security intelligence than success logs by exposing unauthorized access attempts and potential attack vectors.

    • Regulatory Requirements:

      • Regulated sectors such as healthcare and banking are legally obligated to maintain comprehensive accounting records.

      • Under regulations like the Federal Educational Rights and Privacy Act (FERPA) in education and similar healthcare disclosure laws, organizations must be capable of generating an exact audit trail listing every individual—including internal IT personnel troubleshooting systems—who accessed a specific record within a given timeframe.

      • Financial institutions must log precise transactional history, including who opened an account, the exact timestamps, and the specific actions performed.

CIA Triad and Integrity Implications

  • Data Integrity and Breach Reporting:

    • Public breach notifications frequently state: "A security breach occurred, but we have no reason to believe any information was taken."

    • This determination relies entirely on system accounting logs confirming that no files were opened, copied, or exfiltrated.

    • Unaddressed Security Risks: A lack of exfiltration does not guarantee a lack of system compromise. Attackers may alter existing records, insert malicious code, or establish persistent access mechanisms for future exploitation.

  • Advanced Persistent Threats (APTs):

    • Case Study (Accenture): Attackers deployed an Advanced Persistent Threat (APT) that lurked undetected within the corporate network.

    • Mechanics: Rather than disrupting operational availability or altering data, the APT silently duplicated and siphoned client data to an external dataset controlled by the perpetrators without affecting system performance.

    • Interlocking Controls: Proper accounting and integrity monitoring are required to detect silent data duplication and prevent attackers from executing unauthorized privilege escalations or creating unauthorized administrative accounts.

Cybersecurity Mindset and Practitioner Case Studies

  • Adversarial and Critical Thinking:

    • Effective cybersecurity practice requires evaluating systems from the perspective of an attacker seeking to exploit design or operational flaws.

  • Case Study (Franciscan Security Officer):

    • Operational Philosophy: A chief security and compliance officer maintained a default policy of refusing all new technology requests, vendor integrations, and access expansions ("default NO").

    • Defense Requirement: System engineers and managers were required to rigorously demonstrate that they had accounted for usability, threat mitigation, data protection, and secure architecture before obtaining authorization ("arguing to YES").

    • Outcome: Enforced thorough risk assessments and prevented incomplete or insecure implementations driven by operational haste.

Classification of Security Controls

  • Deterrent Controls: Discourage potential attackers from attempting a compromise (e.g., visible security cameras, warning signs, physical security guards, perimeter fences, standard login prompts).

  • Preventative Controls: Directly block an attack or unauthorized access attempt from succeeding (e.g., firewalls, access control lists, encryption).

  • Detective Controls: Identify and record unauthorized or illegal activity as it occurs or after the fact (e.g., Intrusion Detection Systems [IDS], system log audits, motion detectors).

  • Compensating Controls: Alternative security measures implemented when a primary preventative control cannot be deployed due to technical, operational, or financial constraints.

  • Corrective Controls: Re-establish system security, repair damage, and restore normal operations following a detected security breach (e.g., backup restorations, patch deployments, incident response protocols).

    • Career Impact: A significant portion of personnel terminations occur during the corrective phase rather than during the initial breach event, primarily due to an inability to articulate root causes or provide a structured remediation plan.

  • Directive Controls: Guide, steer, or enforce compliance with security behaviors and divert malicious actors away from critical assets (e.g., security policies, corporate guidelines, honeypots, honeynets).

Terminology and Scope: Cybersecurity vs. Information Security

  • Cybersecurity:

    • The overarching discipline encompassing the protection of all digital assets, networks, applications, software programs, and underlying physical infrastructure.

    • Physical Security Integration: Includes physical barrier design, facility access locks, surveillance systems, and structural protection measures.

    • Physical Security Examples:

      • Target Stores: Utilizes heavy, concrete decorative red spheres anchored deep into the ground in front of store entrances as security bollards to prevent vehicle ram-raiding.

      • Ball Corporation: Employs reinforced yellow steel pylons for facility perimeter protection.

      • IBM (Chicago Office): Utilizes heavy structural steel posts concealed entirely inside exterior landscaping bushes to maintain architectural aesthetics while providing anti-ram protection.

  • Information Security (InfoSec):

    • A specialized sub-discipline focused specifically on protecting the confidentiality, integrity, and availability of data—particularly processed data—regardless of storage or transmission medium.

    • Governed heavily by regulatory compliance frameworks such as FERPA, which dictates data usage, storage restrictions, and access permissions in educational environments.

Layers of Security and Data States

  • Three States of Data:

    1. Data in Flight (Transmitted): Data moving across local networks, wide area networks, or the internet. Protected via network security protocols and transit encryption.

    2. Data at Rest (Stored): Static data residing on physical storage media (e.g., hard drives, solid-state drives, storage area networks). Protected via media encryption and file permissions.

    3. Data in Process (Processing): Active data loaded into volatile memory (RAM), CPU registers, or cache during system computation.

  • Hardware Supply Chain Threats to Data in Process:

    • Case Study (Chinese CPU/Motherboard Chips): Manufactured hardware components were discovered with malicious spyware circuitry directly embedded into the silicon on motherboards installed across global server environments. This exposed data in process directly at the hardware layer, bypassing software security controls.

  • Defense-in-Depth Security Layers:

    • Core: Data protection across all three states (flight, rest, process) bounded by the CIA Triad.

    • Products Layer: Technical controls, firewalls, hardware appliances, and security software.

    • People Layer: Security awareness training for all employees.

      • Weakest Link Principle: Human operators represent the primary statistical vulnerability within organizational security perimeters.

      • Non-Profit/Small Business Vulnerability: Studies indicate small organizations frequently omit cybersecurity training entirely due to resource and budget constraints.

    • Policies and Procedures Layer: Establishes administrative rules, operational guidelines, legal protections, and behavioral expectations.

Target Categories and Threat Actor Profiles

  • Target Categories:

    • Mass Individual Users: Targets of opportunistic, high-volume attacks (e.g., broad email phishing campaigns).

    • Enterprises: Targets of corporate espionage, financial extortion, intellectual property theft, and operational disruption (e.g., historical automotive industry theft of vehicle designs during the late 1970s).

    • Governments: Targets of high-profile, wide-scope cyber operations aimed at critical infrastructure, defense networks, and intelligence gathering.

  • Threat Actor Profiles:

    • Unskilled Attackers ("Script Kiddies"):

      • Inexperienced individuals utilizing pre-compiled, publicly available exploit packages downloaded from forums or repositories (e.g., Reddit).

      • Primary Motivation: Curiosity, status, or self-amusement ("because they can").

      • Risk: Advanced cybercriminals frequently embed secondary malware inside public script-kiddie tools, causing unskilled attackers to compromise their own systems upon execution.

    • Organized Crime:

      • Structured syndicates executing operationally sophisticated, financially driven cybercrimes.

      • Shifted away from physical bank robberies due to reduced physical danger and significantly higher financial returns via digital extortion, ransomware, and financial fraud.

    • Insider Threats:

      • Current or former employees, contractors, or business partners with authorized network access.

      • Motivations: Financial gain, coercion, blackmail, or revenge.

      • Physical Sabotage Example: A terminated IT employee entering a wiring closet with hedge clippers and shearing off all network cabling flush against the switch faces.

      • Banking Mitigation Standard: Financial institutions enforce mandatory two-week consecutive vacation policies for branch managers and key staff during which they are completely barred from system access. Unannounced temporary replacements execute all approvals to expose lingering internal fraud schemes.

    • Hacktivists:

      • Individuals or groups executing cyber attacks to advance political, social, or ideological causes (e.g., Anonymous, WikiLeaks leakers, Edward Snowden).

      • Primary Tactics: Website defacement, data leaks, and Distributed Denial of Service (DDoS) attacks.

    • Nation-State Actors:

      • State-sponsored cyber units backed by significant governmental funding, intelligence, and technical resources. Frequently execute Advanced Persistent Threats (APTs) and infrastructure attacks.

Case Study: Stuxnet and Nation-State Attacks

  • Overview: A highly sophisticated cyber weapon developed jointly by the United States (CIA) and Israel.

  • Target: Programmable Logic Controllers (PLCs) controlling uranium enrichment centrifuges at the Natanz nuclear facility in Iran.

  • Air-Gap Traversal: The target network was physically isolated from the internet (air-gapped). Attackers utilized social engineering to induce an insider to insert a physical USB flash drive infected with the malware into a network-connected machine inside the facility.

  • Execution Mechanics:

    • Exploited a zero-day vulnerability in the Windows AutoRun feature.

    • Automatically executed and propagated the instant the infected media was plugged into a machine, requiring no human interaction.

    • Manipulated centrifuge rotational speeds to cause physical self-destruction while sending forged normal telemetry data back to human monitoring consoles.

Shadow IT and Unsanctioned Systems

  • Definition: Hardware, software, cloud services, or network infrastructure deployed within an organization without explicit IT department approval, oversight, or security vetting.

  • Examples:

    • Rogue Wi-Fi access points plugged into internal network jacks.

    • Unsanctioned Software-as-a-Service (SaaS) subscriptions (e.g., employees inputting corporate data into personal Anthropic or ChatGPT accounts instead of enterprise-approved platforms like Microsoft Copilot).

    • Unmanaged personal hardware (e.g., bringing personal laptops or mobile devices to bypass corporate device limitations).

  • Root Causes of Shadow IT:

    • Overly restrictive IT leadership ("Default NO" policies) that fails to provide functional solutions for legitimate employee operational requirements.

    • Operational Example: An employee purchasing an unmanaged secondary